Investigation finds three were hacked by Paragon spyware at same time, potentially fuelling questions for government